The Interplay of Information Processing, Mindfulness, and Affective State in Phishing Detection

2023 | International Conference on Information Systems | Citations: 0

Authors: Bera, Debalina; Kim, Dan

Abstract: This study investigates the effect of individuals' information processing modes ... Expand

Abstract: This study investigates the effect of individuals' information processing modes on phishing email detection mechanisms and accuracy. Drawing on the heuristic-systematic model of processing, mindful decision-making, and affect-and-persuasion literature, this study examines the antecedents (i.e., heuristic, systematic processing, general and domain mindfulness, and affective state) and behavioral consequences (i.e., detection accuracy) in phishing identification. Using a scenario-based survey experiment this study shows mindfulness and affectivity navigate information processing mechanisms, thus influence phishing detection accuracy. It aims to contribute to information security literature by examining novel associations between general, domain mindfulness and its effect on online users' information processing strategy and phishing detection accuracy. Furthermore, this study contributes to phishing training and awareness by identifying the function of cognitive-affective (affective states, trait mindfulness) and cognitive-behavioral (domain mindfulness) factors on the choice of information processing modes and phishing detection accuracy. Finally, the affective states might help improve the efficacy of automatic filters. Collapse

Topics: phishing mindfulness electronic mail email phishing data security

Methods: experiment survey partial least squares regression machine learning laboratory experiment

Theories: protection motivation theory

How “What you think you know about cybersecurity” can help users make more secure decisions

2023 | Information & Management | Citations: 0

Authors: Fard Bahreini, Amir; Cavusoglu, Hasan; Cenfetelli, Ronald T.

Abstract: The increasing use of information technology artifacts in daily life makes secur ... Expand

Abstract: The increasing use of information technology artifacts in daily life makes security a shared responsibility of both users and companies. In recent years, increasing a user’s objective (i.e., actual) security knowledge and providing applications with more secure default settings appear among the most ubiquitous tools companies use to broaden their efforts to help users make more secure decisions. Examining both solutions matters because they are widely used, cost effective, and understood by many security practitioners. Additionally, default settings and users’ objective knowledge provide anchors for decision-making. However, human errors and insecure default settings are increasing and raising further questions about the efficacy of such efforts. Using the theory of bounded ra­ tionality, we investigated the role of objective, subjective (i.e., self-assessed) security knowledge, and default settings security level on the overall decision security. We found that objective security knowledge can lead to secure decisions when paired with high subjective security knowledge. In the absence of the latter, objective security knowledge is unable to lead to better security decisions. Furthermore, subjective security knowledge reduces the extent to which users fully accept default security settings, thereby mitigating bias toward insecure default settings. Collapse

Topics: mobile application data security decision making self efficacy mobile application market

Methods: survey descriptive statistic structural equation modeling literature study post-hoc analysis

Theories: theory of bounded rationality

It's not just about accuracy: An investigation of the human factors in users' reliance on anti-phishing tools

2022 | Decision Support Systems | Citations: 0

Authors: Schuetz, Sebastian W.; Steelman, Zachary R.; Syler, Rhonda A.

Abstract: Phishing attacks pose substantial threats to the security of individuals and org ... Expand

Abstract: Phishing attacks pose substantial threats to the security of individuals and organizations. Although current antiphishing tools achieve high accuracy rates and present a potential solution to this problem, users are often reluctant to rely on the predictions of these competent tools. However, we continue to lack a means of resolving this reluctance—or even an explanation for it. To address this need and advance toward a solution, we inves­ tigate the factors that influence users’ reliance on anti-phishing tools. Over the course of two studies, we test the effects of tool attributes (i.e., accuracy and frequency of phishing email predictions) and develop a model based on the notions of trust and distrust. Countering the common conjecture that tools are not accurate enough, we find that users’ under-reliance is not an artifact of the insufficient accuracy of tools, as even in a 100% accuracy condition, users were under-reliant on tools. Rather, we find that while accuracy increases users’ trust in tools, full reliance is inhibited by users’ distrust, which is driven by a lack of transparency regarding tools’ function­ alities and the quantity of predictions provided. Thus, overall, our study shows the limits of accuracy in engendering reliance and explains the under-reliance phenomenon by showing that due to lack of knowledge or understanding, some users prefer to rely on their own inferior judgment instead of trusting and relying on the predictions provided by highly accurate tools. Collapse

Topics: phishing electronic mail email phishing self efficacy recommender system

Methods: experiment survey theory development analysis of covariance experimental group

Eyes wide open: The role of situational information security awareness for security-related behaviour

2021 | Information Systems Journal | Citations: 0

Authors: Jaeger, Lennart; Eckhardt, Andreas

Abstract: Most contemporary studies on information security focus on largely static phenom ... Expand

Abstract: Most contemporary studies on information security focus on largely static phenomena in examining security-related behaviours. We take a more dynamic, situational and interactionist approach that proposes that security-related behaviours result from an interaction between the person and the perception of a threatening situation. We derive and define situational information security awareness based on situation awareness literature, and examine how individual-level (innate traits, experience) and system-level factors (design variations, warning signal) influence awareness, and how it influences subsequent threat and coping appraisals, and ultimately security-related behaviours in a multi-method phishing experiment including eye tracking and survey components with 107 employees. The results underscore the importance of situational information security awareness and show that past experience with phishing and a security warning increase awareness, while phishing emails' contextual relevance and misplaced salience decrease awareness. Situational information security awareness, in turn, increases perceived threat and perceived coping efficacy and, ultimately, actual behavioural responses to phishing attacks. Collapse

Topics: cybersecurity awareness phishing electronic mail email phishing IT security threat

Methods: oculometry experiment survey partial least squares regression statistical power analysis

Theories: protection motivation theory big five model

Coping behaviors in short message service (SMS)-based disaster alert systems: From the lens of protection motivation theory as elaboration likelihood

2021 | Information & Management | Citations: 0

Authors: Yoo, Chul Woo; Lee, Jaeung; Yoo, Changhyun; Xiao, Nan

Abstract: Short message service (SMS)-based disaster alert systems are used as critical me ... Expand

Abstract: Short message service (SMS)-based disaster alert systems are used as critical methods that inform people of natural disasters. This study investigates how two different decision-making routes influence adaptive copings based upon users’ protection motivations. The two important routes, argument quality and source credibility, are presented as focal antecedents of coping adaptiveness. And perceived threat and coping efficacy are tested as a moderator as elaboration likelihood. To achieve these goals, we propose a theoretical framework and analyze survey data to test the hypotheses. The results illustrate that two elaboration likelihood variables show signif­ icant moderating roles in the proposed research model. Collapse

Topics: missing data self efficacy decision making email phishing

Methods: survey partial least squares regression descriptive statistic survey design structural equation modeling

Theories: elaboration likelihood model protection motivation theory

The Effectiveness of Abstract Versus Concrete Fear Appeals in Information Security

2020 | Journal of Management Information Systems | Citations: 45

Authors: Schuetz, Sebastian W.; Lowry, Paul Benjamin; Pienta, Daniel A.; Thatcher, Jason Bennett

Abstract: Information security (ISec) is a pervasive concern of individuals, organizations ... Expand

Abstract: Information security (ISec) is a pervasive concern of individuals, organizations, and governments. To encourage individuals to engage in and learn about secure behaviors, ISec research has turned to fear appeals, which are short messages that communicate threats and efficacy to elicit protection motivation among recipients. ISec research has reported contradictory findings on what makes fear appeals effective in ISec contexts, and this lack of clarity is problematic, because it may lead to incorrect conclusions. For example, some studies have argued that the mixed findings arise from differences between personal and organizational contexts and that fear appeals do not work well among organizational users. However, this argument has not been empirically tested, and differences in message design provide an equally plausible explanation, which has also not been tested. To reconcile the mixed findings across these studies, we test the effects of context (i.e., personal users vs. organizational users) and degree of message abstractness (i.e., abstract vs. concrete) on fear-appeal outcomes. We draw from construal-level theory to conceptualize the differences between abstract and concrete fear appeals. Across three experiments, we find evidence that concrete fear appeals are more effective than abstract fear appeals for the purpose of stimulating fear-appeal outcomes. Furthermore, by comparing two identical experiments—one conducted with personal users and another conducted with organizational users—we find differences in participants’ responses to fear appeals. However, contrary to our expectations, our findings suggest that organizational users report higher levels of fear and protection motivation than personal users. This finding is not a theoretical contradiction: the theoretical crux of an effective fear appeal is that it must be personally relevant to stimulate fear; correspondingly, we show that concrete fear appeals help stimulate fear and the desired protective response. Moreover, concrete fear appeals increase actual compliance behaviors, not just intentions. Thus, our findings suggest that the mixed findings in the literature may be a product of message abstractness and differences among audiences. This has pivotal implications for how to construct fear appeals in research and practice. Collapse

Topics: phishing self efficacy organizational context internet technology information system use

Methods: survey experiment multivariate analysis of covariance psychometrics chi squared test

Theories: construal level theory

Coping Responses in Phishing Detection: An Investigation of Antecedents and Consequences

2017 | Information Systems Research | Citations: 157

Authors: Wang, Jingguo; Li, Yuan; Rao, H. Raghav

Abstract: This study investigates users’ coping responses in the process of phishing email ... Expand

Abstract: This study investigates users’ coping responses in the process of phishing email detection. Three common responses are identified based on the coping literature: task-focused coping, emotion-focused coping (i.e., worry and self-criticism), and avoidance coping. The three responses are used to conceptualize a higher-order construct, coping adaptiveness, that resides on a continuum between maladaptive coping and adaptive coping (manifested as increased task-focused coping and decreased emotion-focused coping and avoidance coping). Drawing on the extended parallel process model and behavioral decision-making literature, this paper examines the antecedents (i.e., perceived phishing threat, perceived detection efficacy, and phishing anxiety) and behavioral consequences (i.e., detection effort and detection accuracy) of coping adaptiveness. A survey experiment with 547 U.S. consumers was conducted. The results show that perceived detection efficacy increases coping adaptiveness. Partially mediated by phishing anxiety, perceived phishing threat decreases coping adaptiveness. Coping adaptiveness positively impacts the two objective measures in the study, detection effort and detection accuracy. The results also suggest that coping adaptiveness and detection effort have different effects on false positives compared to false negatives: detection effort fully mediates the effect of coping adaptiveness on false positive rate (or detection accuracy related to legitimate emails), but has no impact on false negatives (or detection accuracy related to phishing emails), unlike coping adaptiveness. A post hoc analysis on coping responses reveals two patterns of coping among subjects, throwing more light on coping in phishing detection. Theoretical and practical implications are discussed. The online appendix is available at https://doi-org.ezproxy2.utwente.nl/10.1287/isre.2016.0680. Collapse

Topics: phishing electronic mail email phishing data security internet technology

Methods: survey experiment machine learning descriptive statistic partial least squares regression

Theories: extended parallel process model

Overconfidence in Phishing Email Detection

2016 | Journal of the Association for Information Systems | Citations: 0

Authors: Jingguo Wang; Yuan Li; Rao, H. Raghav

Abstract: This study examines overconfidence in phishing email detection. Researchers beli ... Expand

Abstract: This study examines overconfidence in phishing email detection. Researchers believe that overconfidence (i.e., where one's judgmental confidence exceeds one's actual performance in decision making) can lead to one's adopting risky behavior in uncertain situations. This study focuses on what leads to overconfidence in phishing detection. We performed a survey experiment with 600 subjects to collect empirical data for the study. In the experiment, each subject judged a set of randomly selected phishing emails and authentic business emails. Specifically, we examined two metrics of overconfidence (i.e., overprecision and overestimation). Results show that cognitive effort decreased overconfidence, while variability in attention allocation, dispositional optimism, and familiarity with the business entities in the emails all increased overconfidence in phishing email detection. The effect of perceived self-efficacy of detecting phishing emails on overconfidence was marginal. In addition, all confidence beliefs poorly predicted detection accuracy and poorly explained its variance, which highlights the issue of relying on them to guide one's behavior in detecting phishing. We discuss mechanisms to reduce overconfidence. Collapse

Topics: electronic mail phishing self efficacy email phishing decision making

Methods: survey experiment regression analysis method descriptive statistic paired t-test

An Examination of the Calibration and Resolution Skills in Phishing Email Detection

2016 | Americas Conference on Information Systems | Citations: 0

Authors: Li, Yuan; Wang, Jingguo; Rao, Raghav

Abstract: This study examines individuals’ calibration and resolution skills in phishing e ... Expand

Abstract: This study examines individuals’ calibration and resolution skills in phishing email detection and tests the effects of several factors on both skills. It shows that calibration and resolution are two distinct capabilities of a person to detect phishing emails, and they are subject to the impacts of different factors: while calibration is influenced mostly by task factors such as familiarity with the emails, time to judgment, variability of time to judgment, and task easiness, resolution is influenced by both task factors such as variability of time to judgment and familiarity with the entity in the email, and individual characteristics such as online transaction experience and prior victimization of phishing attacks. The theoretical implication of the study is addressed, and the practical implication for designing effective training programs to improve one’s phishing detection ability is also discussed. Collapse

Topics: electronic mail phishing email phishing self efficacy individual characteristic

Methods: experiment descriptive statistic

The impact of adoption of identity theft countermeasures on firm value

2013 | Decision Support Systems | Citations: 25

Authors: Bose, Indranil; Leung, Alvin Chung Man

Abstract: Identity theft poses a huge threat to the e-commerce community. Although the cri ... Expand

Abstract: Identity theft poses a huge threat to the e-commerce community. Although the crime is a growing menace, firms are uncertain about the payoffs obtained from adoption of identity theft countermeasures. As the cost of implementation of relevant countermeasures is high, senior managers are hesitant to make such investments. Using the event study method, we empirically demonstrate that it is worthy for a firm to adopt such countermeasures. We show that the news of such adoption increases the short term market value of the announcing firm by 0.63% on an average. Our research also finds that early adopters, adopters of sophisticated identity theft countermeasures, firms with high growth potential, and firms with high credit rating show a strong and positive return in market value, whereas small firms demonstrate a moderate but positive reaction. As shown in our research findings, the market rewards early adopters of security technology and adopters of sophisticated measures greatly. To reap the market premium, the industrial practitioners should adopt newer identity theft countermeasures at an earlier time. Furthermore, our study shows that investors reward growing firms and small companies more if they adopt the countermeasures. This shows that the market views the investment in anti-identity theft as a tool to enhance competitive advantage. Our research findings should encourage firms to adopt identity theft countermeasures more proactively. Collapse

Topics: multi-factor authentication information technology capability identity theft data security digital signature

Methods: parametric test event study longitudinal research nonparametric test statistical hypothesis test

Theories: dynamic capabilities theory